Jump to content

Weick

Members
  • Content count

    104
  • Joined

  • Last visited

Posts posted by Weick


  1. Bom dia,

     

    Segue relatório:

    Spoiler

     

    RogueKiller V12.12.30.0 (x64) [Aug  6 2018] (Free) por Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : https://forum.adlice.com
    Site : http://www.adlice.com/download/roguekiller/
    Blog : http://www.adlice.com

    Sistema Operacional : Windows 10 (10.0.17134) 64 bits version
    Iniciou : Modo normal
    Usuário : Maple Bear [Administrador]
    Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
    Modo : Deletar -- Data : 08/08/2018 10:31:13 (Duration : 00:42:42)

    ¤¤¤ Processos : 3 ¤¤¤
    [Root.Wajam] svchost.exe(2672) -- c:\Windows\System32\svchost.exe[7] -> [NoKill]
    [Proc.Injected] rundll32.exe(3436) -- C:\Windows\SysWOW64\rundll32.exe[-] -> Interrompido [TermProc]
    [VT.Detected] hmtjgjdtalqowcqt.zmtjg(3436) -- C:\WINDOWS\hmtjgjdtalqowcqt.zmtjg[-] -> Encontrado

    ¤¤¤ Registro : 17 ¤¤¤
    [PUP.Gen1] (X86) HKEY_LOCAL_MACHINE\Software\mtApService -> Deletado
    [PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\mtApService -> Deletado
    [PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\mtApService -> Deletado
    [PUP.Linkury|VT.Unknown] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\AppmallosayoV (C:\ProgramData\\AppmallosayoV\\AppmallosayoV.exe shuz -f "C:\ProgramData\\AppmallosayoV\\AppmallosayoV.dat" -l -a) -> Deletado
    [Root.Wajam] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ZGZmMzNhODg5MjgyMG (system32\drivers\ZGZmMzNhODg5MjgyMG.sys) -> Deletado
    [PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Start Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkazK6e0NISXaBrBIUb80Xv37wYgvgeZrUGAYS7LpXr6RVcLqb0EkSR5blLVcOkNF3LOjl9e584hcnXTem  -> Substituído (http://go.microsoft.com/fwlink/p/?LinkId=255141)
    [PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Start Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkazK6e0NISXaBrBIUb80Xv37wYgvgeZrUGAYS7LpXr6RVcLqb0EkSR5blLVcOkNF3LOjl9e584hcnXTem  -> Substituído (http://go.microsoft.com/fwlink/p/?LinkId=255141)
    [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Search Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms}  -> Substituído (http://go.microsoft.com/fwlink/?LinkId=54896)
    [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Search Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms}  -> Substituído (http://go.microsoft.com/fwlink/?LinkId=54896)
    [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms}  -> Substituído (http://search.msn.com/spbasic.htm)
    [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms}  -> Substituído (http://search.msn.com/spbasic.htm)
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 179.232.0.31 179.232.0.36 201.6.4.116 ([Brazil][Brazil][-])  -> Não selecionado
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{e31b5f51-1d5b-4fb3-8c6c-f0154f10d3bc} | DhcpNameServer : 179.232.0.31 179.232.0.36 201.6.4.116 ([Brazil][Brazil][-])  -> Não selecionado
    [PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> Substituído (2)
    [PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> Substituído (2)
    [VT.Detected] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs : C:\ProgramData\AppmallosayoV\Stannix.dll [-] -> Substituído ()
    [VT.Detected] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs : C:\ProgramData\AppmallosayoV\Med-Ex.dll [-] -> Substituído ()

    ¤¤¤ Tarefas : 0 ¤¤¤

    ¤¤¤ Arquivos : 15 ¤¤¤
    [PUP.Linkury][Arquivo] C:\ProgramData\AppmallosayoV\AppmallosayoV.exe -> Deletado
    [PUP.Gen0][Arquivo] C:\Windows\SECOH-QAD.exe -> Deletado
    [PUP.Linkury][Arquivo] C:\Windows\SysWOW64\findit.xml -> Deletado
    [Root.Wajam][Arquivo] C:\Windows\System32\drivers\ZGZmMzNhODg5MjgyMG.sys -> Removido na reinicialização [5]
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.0_43458\utorrentie.exe -> Deletado
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44366\utorrentie.exe -> Deletado
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44390\utorrentie.exe -> Deletado
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44416\utorrentie.exe -> Deletado
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44472\utorrentie.exe -> Deletado
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44484\utorrentie.exe -> Deletado
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.4_44488\utorrentie.exe -> Deletado
    [PUP.Linkury][Arquivo] C:\Users\Maple Bear\AppData\Local\Vaiadex.exe -> Deletado
    [PUP.Linkury][Arquivo] C:\ProgramData\AppmallosayoV\AppmallosayoV.exe -> Removido na reinicialização [2]
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\AccessVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\AccessVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\AccessVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\Access_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\Access_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\Access_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\Access_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\Access_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Access -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\ExcelVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\ExcelVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\ExcelVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\Excel_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\Excel_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\Excel_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\Excel_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\Excel_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Excel -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\GrooveVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\GrooveVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\GrooveVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\Groove_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\Groove_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\Groove_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\Groove_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\Groove_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Groove -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPathVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPathVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPathVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNoteVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNoteVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNoteVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNote_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNote_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNote_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNote_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNote_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\OneNote -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\OutlookVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\OutlookVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\OutlookVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\Outlook_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\Outlook_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\Outlook_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\Outlook_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\Outlook_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Outlook -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPointVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPointVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPointVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectProVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectProVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectProVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStdVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStdVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStdVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlusVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlusVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlusVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\PublisherVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\PublisherVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\PublisherVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\Publisher_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\Publisher_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\Publisher_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\Publisher_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\Publisher_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Publisher -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\StandardVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\StandardVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\StandardVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\Standard_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\Standard_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\Standard_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\Standard_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\Standard_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Standard -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPrem_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPrem_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPrem_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPrem_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPrem_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPro_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPro_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPro_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPro_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPro_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioStd_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioStd_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioStd_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioStd_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioStd_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioVLRegWOW.reg -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Visio -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\WordVLReg32.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\WordVLReg64.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\WordVLRegWOW.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\Word_KMS_Client.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\Word_KMS_Client.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\Word_KMS_Client.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\Word_KMS_Client.RAC_Priv.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\Word_KMS_Client.RAC_Pub.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Word -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Access\AccessVL_KMS_Client_OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Access\AccessVL_KMS_Client_PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Access\AccessVL_KMS_Client_PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Access -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Excel -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\InfoPath -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Lync -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\OneNote -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Outlook -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\pkeyconfig-office.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\proplus.reg -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\ProPlus -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Publisher -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Standard -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\visio.reg -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\VisioPro -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\VisioStd -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.OOB.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.PL.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.PPDLIC.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Word -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Access\AccessVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Access\AccessVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Access\AccessVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Access -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-bridge-office.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-root-bridge-test.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-root.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-stil.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-ul.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Excel -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Mondo -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\OneNote -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Outlook -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\pkeyconfig-office.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\ProPlus -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Publisher -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Standard\StandardVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Standard\StandardVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Standard\StandardVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Standard -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\VisioPro -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\VisioStd -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Word\WordVL_KMS_Client-ppd.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Word\WordVL_KMS_Client-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Word\WordVL_KMS_Client-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Word -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW10\Core -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Education\Education-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Education\Education-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW10\Education -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW10\Enterprise -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-2-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-2-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\pkeyconfig.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW10\Professional -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW10 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-ul-phn.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-RAC-private.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-RAC-public.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-ul.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-pl.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-ul-phn.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-pl.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-ul-phn.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW6\Business -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-ul-phn.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-RAC-private.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-RAC-public.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-ul.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-pl.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-ul-phn.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-pl.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-ul-phn.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-ul-phn.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-RAC-private.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-RAC-public.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-ul.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-pl.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-ul-phn.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-pl.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-ul-phn.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\pkeyconfig.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW6 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Embedded\pkeyconfig-embedded.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-pl.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-ul-phn.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-VLBA-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-VLBA-ul.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW7\Embedded -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW7\Enterprise -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\pkeyconfig.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-ul-phn.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-RAC-private.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-RAC-public.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-ul.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-pl.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-ul-oob.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-ul-phn.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW7\Professional -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW7 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\Core -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\CoreN\CoreN-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\CoreN\CoreN-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\CoreN -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\CoreSingleLanguage-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\CoreSingleLanguage-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\Enterprise -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\EnterpriseN-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\EnterpriseN-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\pkeyconfig.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\Professional -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\ProfessionalN-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\ProfessionalN-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\Core -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\CoreConnectedSingleLanguage-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\CoreConnectedSingleLanguage-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\EmbeddedIndustry-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\EmbeddedIndustry-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\Enterprise -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\pkeyconfig.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\Professional -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\ServerDatacenter-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\ServerDatacenter-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\ServerStandard-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\ServerStandard-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81 -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\driver\Cert.cmd -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\driver\certELDI.pfx -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\driver\OpenVPN.cer -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\driver\tap-windows-9.21.0.exe -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\driver\UnInstallDriver.cmd -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\driver -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\icons\Error.png -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\icons\Information.png -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\icons\Question.png -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\icons\Warning.png -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\icons -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\logs\AutoPico.log -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\logs\KMSELDI.log -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\logs\Service_KMS.log -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\logs -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\AddExceptionsWD.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\AddExceptions_Defender.cmd -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\DisableSmartScreen.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\EnableSmartScreen.cmd -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\EnableSmartScreen.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\Install_Service.cmd -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\Install_Task.cmd -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\Log.cmd -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\RemoveExceptionsWD.reg -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\Restore_Watermark.cmd -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\Silent.cmd -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\UnInstall_Service.cmd -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\scripts -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\affirmative.mp3 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\begin.mp3 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\complete.mp3 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\diagnostic.mp3 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\enterauthorizationcode.mp3 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\incomingtransmission.mp3 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\inputfailed.mp3 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\inputok.mp3 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\processing.mp3 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\transfer.mp3 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\verified.mp3 -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\warning.mp3 -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\sounds -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\TokensBackup\Keys.txt -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\TokensBackup\Windows\cache\cache.dat -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\TokensBackup\Windows\cache -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\TokensBackup\Windows\data.dat -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\TokensBackup\Windows\pkeyconfig.xrm-ms -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\TokensBackup\Windows\tokens.dat -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\TokensBackup\Windows -> Deletado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico\TokensBackup -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\unins000.dat -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\unins000.exe -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\UninsHs.exe -> Deletado
    [PUP.HackTool][Arquivo] C:\Program Files\KMSpico\Vestris.ResourceLib.dll -> Deletado
    [PUP.Multitimer][Pasta] C:\Program Files (x86)\Multitimer -> Deletado

    ¤¤¤ WMI : 0 ¤¤¤

    ¤¤¤ Arquivos de hosts : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Carregado) ¤¤¤

    ¤¤¤ Navegadores : 0 ¤¤¤

    ¤¤¤ Verificação da MBR : ¤¤¤
    +++++ PhysicalDrive0: ST500LM012 HN-M500MBB +++++
    --- User ---
    [MBR] 5aef40578600422a06b842a9ae851aa2
    [BSP] 980fe462507a6040b4abe904a693c5ba : Empty MBR Code
    Partition table:
    0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 100 MB
    1 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 206848 | Size: 128 MB
    2 - Basic data partition | Offset (sectors): 468992 | Size: 463814 MB
    3 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 950362112 | Size: 930 MB
    4 - [SYSTEM][MAN-MOUNT] ??????a | Offset (sectors): 952266754 | Size: 10941 MB
    5 - [SYSTEM][MAN-MOUNT] ????? | Offset (sectors): 974673923 | Size: 1024 MB
    User = LL1 ... OK
    User = LL2 ... OK

     

     


  2. Consegui!

     

    Segue report:

    Spoiler

     

    RogueKiller V12.12.30.0 (x64) [Aug  6 2018] (Free) por Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : https://forum.adlice.com
    Site : http://www.adlice.com/download/roguekiller/
    Blog : http://www.adlice.com

    Sistema Operacional : Windows 10 (10.0.17134) 64 bits version
    Iniciou : Modo normal
    Usuário : Maple Bear [Administrador]
    Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
    Modo : Escanear -- Data : 08/08/2018 10:31:13 (Duration : 00:42:42)

    ¤¤¤ Processos : 3 ¤¤¤
    [Root.Wajam] svchost.exe(2672) -- c:\Windows\System32\svchost.exe[7] -> Encontrado
    [Proc.Injected] rundll32.exe(3436) -- C:\Windows\SysWOW64\rundll32.exe[-] -> Encontrado
    [VT.Detected] hmtjgjdtalqowcqt.zmtjg(3436) -- C:\WINDOWS\hmtjgjdtalqowcqt.zmtjg[-] -> Encontrado

    ¤¤¤ Registro : 17 ¤¤¤
    [PUP.Gen1] (X86) HKEY_LOCAL_MACHINE\Software\mtApService -> Encontrado
    [PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\mtApService -> Encontrado
    [PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\mtApService -> Encontrado
    [PUP.Linkury|VT.Unknown] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\AppmallosayoV (C:\ProgramData\\AppmallosayoV\\AppmallosayoV.exe shuz -f "C:\ProgramData\\AppmallosayoV\\AppmallosayoV.dat" -l -a) -> Encontrado
    [Root.Wajam] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ZGZmMzNhODg5MjgyMG (system32\drivers\ZGZmMzNhODg5MjgyMG.sys) -> Encontrado
    [PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Start Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkazK6e0NISXaBrBIUb80Xv37wYgvgeZrUGAYS7LpXr6RVcLqb0EkSR5blLVcOkNF3LOjl9e584hcnXTem  -> Encontrado
    [PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Start Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkazK6e0NISXaBrBIUb80Xv37wYgvgeZrUGAYS7LpXr6RVcLqb0EkSR5blLVcOkNF3LOjl9e584hcnXTem  -> Encontrado
    [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Search Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms}  -> Encontrado
    [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Search Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms}  -> Encontrado
    [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms}  -> Encontrado
    [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms}  -> Encontrado
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 179.232.0.31 179.232.0.36 201.6.4.116 ([Brazil][Brazil][-])  -> Encontrado
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{e31b5f51-1d5b-4fb3-8c6c-f0154f10d3bc} | DhcpNameServer : 179.232.0.31 179.232.0.36 201.6.4.116 ([Brazil][Brazil][-])  -> Encontrado
    [PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> Encontrado
    [PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> Encontrado
    [VT.Detected] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs : C:\ProgramData\AppmallosayoV\Stannix.dll [-] -> Encontrado
    [VT.Detected] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs : C:\ProgramData\AppmallosayoV\Med-Ex.dll [-] -> Encontrado

    ¤¤¤ Tarefas : 0 ¤¤¤

    ¤¤¤ Arquivos : 15 ¤¤¤
    [PUP.Linkury][Arquivo] C:\ProgramData\AppmallosayoV\AppmallosayoV.exe -> Encontrado
    [PUP.Gen0][Arquivo] C:\Windows\SECOH-QAD.exe -> Encontrado
    [PUP.Linkury][Arquivo] C:\Windows\SysWOW64\findit.xml -> Encontrado
    [Root.Wajam][Arquivo] C:\Windows\System32\drivers\ZGZmMzNhODg5MjgyMG.sys -> Encontrado
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.0_43458\utorrentie.exe -> Encontrado
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44366\utorrentie.exe -> Encontrado
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44390\utorrentie.exe -> Encontrado
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44416\utorrentie.exe -> Encontrado
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44472\utorrentie.exe -> Encontrado
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44484\utorrentie.exe -> Encontrado
    [PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.4_44488\utorrentie.exe -> Encontrado
    [PUP.Linkury][Arquivo] C:\Users\Maple Bear\AppData\Local\Vaiadex.exe -> Encontrado
    [PUP.Linkury][Arquivo] C:\ProgramData\AppmallosayoV\AppmallosayoV.exe -> Encontrado
    [PUP.HackTool][Pasta] C:\Program Files\KMSpico -> Encontrado
    [PUP.Multitimer][Pasta] C:\Program Files (x86)\Multitimer -> Encontrado

    ¤¤¤ WMI : 0 ¤¤¤

    ¤¤¤ Arquivos de hosts : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Carregado) ¤¤¤

    ¤¤¤ Navegadores : 0 ¤¤¤

    ¤¤¤ Verificação da MBR : ¤¤¤
    +++++ PhysicalDrive0: ST500LM012 HN-M500MBB +++++
    --- User ---
    [MBR] 5aef40578600422a06b842a9ae851aa2
    [BSP] 980fe462507a6040b4abe904a693c5ba : Empty MBR Code
    Partition table:
    0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 100 MB
    1 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 206848 | Size: 128 MB
    2 - Basic data partition | Offset (sectors): 468992 | Size: 463814 MB
    3 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 950362112 | Size: 930 MB
    4 - [SYSTEM][MAN-MOUNT] ??????a | Offset (sectors): 952266754 | Size: 10941 MB
    5 - [SYSTEM][MAN-MOUNT] ????? | Offset (sectors): 974673923 | Size: 1024 MB
    User = LL1 ... OK
    User = LL2 ... OK

     

     


  3. Em 07/08/2018 at 10:09, DigRam disse:

    > Estes objetos/arquivos,ainda aparecem na linha de processos?

    Olá,

     

    Não, estes processos não aparecem mais no gerenciador de tarefas.

     

    Estou enfrentando dificuldades com o RogueKiller. Ele inicia o scan, mas em um dado momento, ele fecha sozinho (da mesma forma que a página do fórum fecha sozinha). Quando tento abrir o RogueKiller novamente (indo pelo diretório em C:/Arquivos de Programas/...) a própria pasta fecha sozinha, não me permitindo abrir o programa. Daí tenho que reiniciar o computador para tentar novamente.

     

    É isso que estou fazendo agora, rodando o scan mais uma vez para ver se consigo e então postar o relatório. Se tiver alguma dica de como fazer isso, agradeceria.


  4. Consegui.

    Segue relatório.

     

    Rapport de ZHPFix 2017.06.13.1 par Nicolas Coolman, Update du 13/06/2017
    Fichier d'export Registre : 
    Run by Maple Bear at 07/08/2018 06:43:35
    High Elevated Privileges : OK
    Windows 8 Home Premium Edition, 64-bit Service Pack 1 (17134)

    Reciclagem vazia (00mn 14s)
    Prefetcher vazio
    Reparação de atalhos do navegador

    ========== Processo memória ==========
    ELIMINA REINICIAR: Memory Process: C:\Program Files\ZTUzZWM3NDExNGQ0ZWU\YjZjZWFiYjljMDE3.exe
    ELIMINA REINICIAR: Memory Process: C:\WINDOWS\System32\drivers\ZGZmMzNhODg5MjgyMG.sys

    ========== Estado dos serviços ==========
    ZTUzZWM3NDExNGQ0ZWU Parado

    ========== Chaves do Registo ==========
    ELIMINÉ:³ Service: ZTUzZWM3NDExNGQ0ZWU
    ELIMINÉ:³ HKLM\SYSTEM\CurrentControlSet\Services\ZTUzZWM3NDExNGQ0ZWU
    ELIMINÉ:³ HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\WinRAR32
    ELIMINÉ:³ HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32
    ELIMINÉ: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{ielnksrch}
    ELIMINÉ: HKCU\SOFTWARE\Chromium

    ========== Valores do Registo ==========
    ELIMINÉ RunValue: 306X312R0NHD77K
    ELIMINÉ RunValue: 9076895
    ELIMINÉ RunValue: 6008864
    ELIMINÉ RunValue: Spotify
    ELIMINÉ RunValue: Free Download Manager
    ELIMINÉ RunValue: IXM5LGBMJKNOYPO
    ELIMINÉ RunValue: 7684565
    ELIMINÉ RunValue: KWTAR679ZT9XGIA
    ELIMINÉ RunValue: 4640116
    ELIMINÉ RunValue: 4ND541F9JDTDJ4C
    ELIMINÉ RunValue: 6777332
    ELIMINÉ RunValue: 3IBJM5C6ZA1W7IK
    ELIMINÉ RunValue: 9391062
    ELIMINÉ RunValue: MATTCRY3VVPWWAE
    ELIMINÉ RunValue: 4649048
    ELIMINÉ RunValue: EWN6U5GCCBBNP1N
    ELIMINÉ RunValue: 3673502
    Ausente Valor Perfil Padrão: FirewallRaz : 
    Ausente Valor Perfil Domínio FirewallRaz : 
    Nenhum valor presente na chave de exceções do registo (FirewallRaz)

    ========== Elementos dos dados do Registo ==========
    ELIMINÉ: R1 Search Page = https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms}

    ========== Preferências do navegador ==========
    AGORA Chrome File: C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Preferences
    AUSENTE Chrome Site: http://feed.helperbar.com

    ========== Pastas ==========
    Nenhuma pasta CLSID local utilizador vazia

    ========== Ficheiros ==========
    ELIMINÉ Temporários windows (3125) (129.086.696 octets)

    ========== Outros ==========
    NÃO-TRATADO R1 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bars6_isuxz8ecled5h03pp-8ep6i0mrllcscmz5cao3siojmzsbgoi&q={searchterms}
    NÃO-TRATADO [HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\SOFTWARE\Chromium]


    ========== Recapitulativo ==========
    2 : Processo memória
    6 : Chaves do Registo
    20 : Valores do Registo
    1 : Elementos dos dados do Registo
    1 : Pastas
    1 : Ficheiros
    2 : Preferências do navegador
    1 : Estado dos serviços
    2 : Outros


    End of clean in 06mn 37s

    ========== Caminho do ficheiro do relatório ==========
    C:\Users\Maple Bear\AppData\Roaming\ZHP\ZHPFix[R1].txt - 07/08/2018 06:43:49 [3117]
     


  5. Spoiler

     

    # -------------------------------
    # Malwarebytes AdwCleaner 7.2.2.0
    # -------------------------------
    # Build:    07-17-2018
    # Database: 2018-07-25.1
    # Support: https://www.malwarebytes.com/support
    #
    # -------------------------------
    # Mode: Clean
    # -------------------------------
    # Start:    07-27-2018
    # Duration: 00:00:06
    # OS:       Windows 10 Home Single Language
    # Cleaned:  36
    # Failed:   0


    ***** [ Services ] *****

    No malicious services cleaned.

    ***** [ Folders ] *****

    Deleted       C:\ProgramData\Voyasollams
    Deleted       C:\Windows\Syswow64\SSL
    Deleted       C:\Users\Maple Bear\AppData\Local\WhiteClick

    ***** [ Files ] *****

    Deleted       C:\Users\Maple Bear\appdata\local\installationconfiguration.xml
    Deleted       C:\Users\Maple Bear\AppData\Local\Main.dat
    Deleted       C:\Windows\SysWOW64\findit.xml

    ***** [ DLL ] *****

    No malicious DLLs cleaned.

    ***** [ WMI ] *****

    No malicious WMI cleaned.

    ***** [ Shortcuts ] *****

    No malicious shortcuts cleaned.

    ***** [ Tasks ] *****

    No malicious tasks cleaned.

    ***** [ Registry ] *****

    Deleted       HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\11598763487076930564
    Deleted       HKLM\Software\MICROSOFT\TechnologyDesktopnew
    Deleted       HKLM\SOFTWARE\MICROSOFT\Speedycar
    Deleted       HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VOYASOLLAM.EXE
    Deleted       HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VOYASOLLAM.EXE
    Deleted       HKLM\Software\Wow6432Node\mtVoyasollam
    Deleted       HKCU\Software\Microsoft\BigTime
    Deleted       HKLM\Software\Microsoft\DMunversion
    Deleted       HKLM\Software\Wow6432Node\MICROSOFT\WINDOWS NT\CURRENTVERSION\SILENTPROCESSEXIT\Voyasollam.exe
    Deleted       HKU\S-1-5-18\Environment|SNP
    Deleted       HKLM\System\CurrentControlSet\Services\EventLog\Application\Application Hosting
    Deleted       HKCU\Software\Microsoft\Internet Explorer\SearchScopes|DefaultScope
    Deleted       HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes|DefaultScope
    Deleted       HKCU\Software\mtApService
    Deleted       HKLM\Software\Wow6432Node\mtApService
    Deleted       HKU\.DEFAULT\Environment|SNP
    Deleted       HKCU\Software\MICROSOFT\wewewe
    Deleted       HKLM\Software\Wow6432Node\SrcAAAesom Browser Enhancer
    Deleted       HKLM\Software\SrcAAAesom Browser Enhancer
    Deleted       HKCU\Software\WajIEnhance
    Deleted       HKLM\Software\Wow6432Node\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9
    Deleted       HKLM\SOFTWARE\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9
    Deleted       HKCU\Software\Microsoft\{cc6eb6d8-85b7-435p-8b86-51e4d16ea76d}
    Deleted       HKLM\Software\Microsoft\PrIncub
    Deleted       HKLM\Software\Microsoft\MPrForShutT
    Deleted       HKLM\Software\Microsoft\PrAmNP
    Deleted       HKLM\Software\Microsoft\NSaveA
    Deleted       HKLM\Software\Microsoft\APreSam

    ***** [ Chromium (and derivatives) ] *****

    No malicious Chromium entries cleaned.

    ***** [ Chromium URLs ] *****

    Deleted       https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuLH2byhed3g02SoNi4QVwBEebRpqZKmL_uily4GbZLL5c-S2_83jfzjLCAmslX9v8De2p5UnTR7OZrqB6TiKmHBKNCMQJsDrNkA2VHtl91WB1_gXrmK0g6Tjopl3f2-uQcxd6S_eLB0OZbOs1a3i7SMuyBGMDn
    Deleted       WebSearch

    ***** [ Firefox (and derivatives) ] *****

    No malicious Firefox entries cleaned.

    ***** [ Firefox URLs ] *****

    No malicious Firefox URLs cleaned.


    *************************

    [+] Delete IFEO
    [+] Delete Prefetch
    [+] Delete Tracing Keys
    [+] Reset Chromium Policies
    [+] Reset IE Policies
    [+] Reset Proxy Settings

    *************************

    AdwCleaner[S00].txt - [4254 octets] - [27/07/2018 17:44:41]

    ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########

     

     


  6. Bom dia,

     

    Segue relatório: https://www.cjoint.com/c/HGBjYdacpl7

     

    Reiniciei o computador e as janelas do Edge não aparecem mais. Acho que estamos perto da solução! A única coisa que estou achando estranha são esses processos que aparecem no gerenciador de tarefas (segue print).

     

    Obrigado,

    Weick

    Processos.png


  7. Segue log:

     

    Resultado da Correção pela Farbar Recovery Scan Tool (x64) Versão: 21.07.2018

    Executado por Maple Bear (26-07-2018 14:22:16) Run:2

    Executando a partir de C:\Users\Maple Bear\Desktop

    Perfis Carregados: Maple Bear (Perfis Disponíveis: Maple Bear)

    Modo da Inicialização: Normal

    ==============================================

     

    fixlist Conteúdo:

    *****************

    CHR NewTab: Default -> "active" : true,

    "entry" : "chrome-extension://pbdpajcdgknpendpmecafmopknefafha/index.html"

    CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-03-31]

    CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha [2018-07-25]

    CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-05-04] 

    *****************

     

    "Chrome NewTab" => removido (a) com sucesso.

    "entry" : "chrome-extension://pbdpajcdgknpendpmecafmopknefafha/index.html" => Erro: Nenhuma correção automática foi encontrada para esta entrada.

    CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-03-31] => Erro: Nenhuma correção automática foi encontrada para esta entrada.

    CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha [2018-07-25] => Erro: Nenhuma correção automática foi encontrada para esta entrada.

    CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-05-04] => Erro: Nenhuma correção automática foi encontrada para esta entrada.

     

    ==== Fim de Fixlog 14:22:17 ====


  8. Olá,

     

    Depois de tentar ativar o office, acho que o computador ficou infectado por vírus. Trava o tempo todo e fica abrindo páginas no navegador Edge sem parar. Verifiquei com o SDefender, mas não encontrou nenhuma ameaça. Seguem logs:

     

    Addition: https://www.cjoint.com/c/HGzoVqnmOI7
    FRST: https://www.cjoint.com/c/HGzoWHMtph7

     

    Obrigado,

    Weick

    Edit: receio ter aberto o tópico no local errado. Tentei mover, mas acredito que somente moderadores podem fazer isso. Caso esteja em local errado, peço a gentileza de mover.


  9. DigRam,

    Ela deu uma melhorada considerável, mas ainda apresenta lentidão. Quando o programa finalizou as correções e rebootou o notebook, observei a inicialização e ela foi tão demorada quando antes (por volta de 3~4 minutos até que a barra de tarefas estivesse com so ícones carregados e eu pudesse clicar em algum deles. O desempenho geral, agora que o notebook está ligado, está relativamente melhor, mas ainda um pouco longe do ideal.

    Obrigado,
    Weick


  10. DigRam,

    Eu não consegui extrair o arquivo para o pen drive, ele apenas me dava a opção de instalar e a instalação foi feita no disco C. Rodei o programa seguindo as etapas sugeridas (marquei apenas as caixas em vermelho). Segue relatório:

    Tweaking.com - Windows Repair v3.9.24

    --------------------------------------------------------------------------------

    System Variables

    --------------------------------------------------------------------------------

    OS: Windows 10 Pro

    OS Architecture: 64-bit

    OS Version: 10.0.14393.693

    OS Service Pack:

    Computer Name: DESKTOP-90OM0O5

    Windows Drive: C:\

    Windows Path: C:\WINDOWS

    Program Files: C:\Program Files

    Program Files (x86): C:\Program Files (x86)

    Current Profile: C:\Users\DoAsnoPC

    Current Profile SID: S-1-5-21-274241934-1915277421-3324831707-1001

    Current Profile Classes: S-1-5-21-274241934-1915277421-3324831707-1001_Classes

    Profiles Location: C:\Users

    Profiles Location 2: C:\WINDOWS\ServiceProfiles

    Local Settings AppData: C:\Users\DoAsnoPC\AppData\Local

    --------------------------------------------------------------------------------

    System Information

    --------------------------------------------------------------------------------

    System Up Time: 01 Day 08:59:18

    Process Count: 81

    Commit Total: 3,28 GB

    Commit Limit: 5,03 GB

    Commit Peak: 4,77 GB

    Handle Count: 46559

    Kernel Total: 366,54 MB

    Kernel Paged: 267,25 MB

    Kernel Non Paged: 99,29 MB

    System Cache: 1,83 GB

    Thread Count: 1281

    --------------------------------------------------------------------------------

    Memory Before Cleaning with CleanMem

    --------------------------------------------------------------------------------

    Memory Total: 3,88 GB

    Memory Used: 2,09 GB(53,8396%)

    Memory Avail.: 1,79 GB

    --------------------------------------------------------------------------------

    Cleaning Memory Before Starting Repairs...

    Memory After Cleaning with CleanMem

    --------------------------------------------------------------------------------

    Memory Total: 3,88 GB

    Memory Used: 1,79 GB(46,2856%)

    Memory Avail.: 2,08 GB

    --------------------------------------------------------------------------------

    Starting Repairs...

    Started at (25/01/2017 19:36:05)

    Setting Any Missing 'InstallDate' From Uninstall Sections Before Running Repair...

    Total Missing 'InstallDate' Fixed: 35

    01 - Reset Registry Permissions

    Restore Windows 7/8/10 Default Registry Permissions

    Start (25/01/2017 19:36:08)

    Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\10\hku.7z

    Done, 0,81 seconds.

    Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\10\hklm.7z

    Done, 16,03 seconds.

    Running Repair Under System Account

    Done (25/01/2017 19:37:40)

    Reset File Permissions

    Restore Windows 7/8/10 Default File Permissions

    Start (25/01/2017 19:37:40)

    Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\10\default.7z

    Done, 0,52 seconds.

    Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\10\profile.7z

    Done, 0,37 seconds.

    Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\10\program_files.7z

    Done, 0,92 seconds.

    Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\10\program_files_x86.7z

    Done, 0,28 seconds.

    Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\10\programdata.7z

    Done, 0,34 seconds.

    Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\10\windows.7z

    Done, 3,88 seconds.

    Running Repair Under Current User Account

    Done (25/01/2017 20:05:14)

    03 - Reset Service Permissions

    Start (25/01/2017 20:05:14)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:05:57)

    04 - Register System Files

    Start (25/01/2017 20:05:57)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:11:25)

    05 - Repair WMI

    Start (25/01/2017 20:11:25)

    Starting Security Center So We Can Export The Security Info.

    Exporting Antivirus Info...

    Exporting 3rd Party Firewall Info...

    Running Repair Under Current User Account

    Done (25/01/2017 20:19:17)

    06 - Repair Windows Firewall

    Start (25/01/2017 20:19:18)

    Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\10\services.7z

    Done, 0,42 seconds.

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:20:12)

    07 - Repair Internet Explorer

    Start (25/01/2017 20:20:12)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:24:28)

    09 - Repair Hosts File

    Start (25/01/2017 20:24:28)

    Running Repair Under System Account

    Done (25/01/2017 20:24:29)

    10 - Remove Policies Set By Infections

    Start (25/01/2017 20:24:29)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:24:36)

    11 - Repair Start Menu Icons Removed By Infections

    Start (25/01/2017 20:24:36)

    Running Repair Under System Account

    Done (25/01/2017 20:24:38)

    12 - Repair Icons

    Start (25/01/2017 20:24:38)

    Running Repair Under Current User Account

    Done (25/01/2017 20:24:46)

    13 - Repair Network

    Start (25/01/2017 20:24:46)

    Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\10\services.7z

    Done, 0,23 seconds.

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:26:37)

    14 - Remove Temp Files

    Start (25/01/2017 20:26:37)

    Running Repair Under System Account

    Done (25/01/2017 20:26:38)

    15 - Repair Proxy Settings

    Start (25/01/2017 20:26:38)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:26:41)

    17 - Repair Windows Updates

    Start (25/01/2017 20:26:41)

    Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\10\services.7z

    Done, 0,22 seconds.

    Running Repair Under Current User Account

    Running Repair Under System Account

    Setting Windows Updates Files That Are In Use To Be Removed At Next Boot.

    Done (25/01/2017 20:27:36)

    23.01 - Repair bat Association

    Start (25/01/2017 20:27:36)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:27:38)

    23.02 - Repair cmd Association

    Start (25/01/2017 20:27:38)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:27:40)

    23.03 - Repair com Association

    Start (25/01/2017 20:27:40)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:27:43)

    23.04 - Repair Directory Association

    Start (25/01/2017 20:27:43)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:27:45)

    23.05 - Repair Drive Association

    Start (25/01/2017 20:27:45)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:27:47)

    23.06 - Repair exe Association

    Start (25/01/2017 20:27:47)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:27:50)

    23.07 - Repair Folder Association

    Start (25/01/2017 20:27:50)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:27:52)

    23.08 - Repair inf Association

    Start (25/01/2017 20:27:52)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:27:54)

    23.09 - Repair lnk (Shortcuts) Association

    Start (25/01/2017 20:27:54)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:27:57)

    23.10 - Repair msc Association

    Start (25/01/2017 20:27:57)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:27:59)

    23.11 - Repair reg Association

    Start (25/01/2017 20:27:59)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:28:01)

    23.12 - Repair scr Association

    Start (25/01/2017 20:28:01)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:28:04)

    26 - Restore Important Windows Services

    Start (25/01/2017 20:28:04)

    Decompressing & Updating Windows Permission File C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\permissions\10\services.7z

    Done, 0,22 seconds.

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:28:22)

    27 - Set Windows Services To Default Startup

    Start (25/01/2017 20:28:22)

    Running Repair Under Current User Account

    Running Repair Under System Account

    Done (25/01/2017 20:28:34)

    Cleaning up empty logs...

    All Selected Repairs Done.

    Done at (25/01/2017 20:28:34)

    Total Repair Time: 00:52:33

    ...YOU MUST RESTART YOUR SYSTEM...

    Obrigado,

    Weick


  11. DigRam,

    O SFCFix mostrou uma mensagem de erro durante a verificação e perguntou se eu gostaria de enviar o report to erro para o suporte. Eu enviei.

    Segue relatório:

    SFCFix version 3.0.0.0 by niemiro.
    Start time: 2017-01-25 15:01:10.155
    Microsoft Windows 10 Build 14393 - amd64
    Using .txt script file at C:\Users\DoAsnoPC\Desktop\SFCScript.txt [0]
    SFCFix version 3.0.0.0 by niemiro has encountered an unhandled exception.
    Currently storing 0 datablocks.
    Finish time: 2017-01-25 15:08:35.849
    Script hash: eGnrm57ERE3Mhc1nIEjI+W2HmjCnpdSFsP6ffCDIJMU=
    ----------------------EOF-----------------------
    Obrigado,
    Weick

  12. DigRam,

    Já fiz umas transferências de pastas de seriados do disco C para o disco E.

    Segue relatório:

    Rapport de ZHPFix 2015.10.19.9 par Nicolas Coolman, Update du 19/10/2015

    Fichier d'export Registre :
    Run by DoAsnoPC at 25/01/2017 14:08:31
    High Elevated Privileges : OK
    Windows 8 Business Edition, 64-bit Service Pack 1 (14393)
    Reciclagem vazia (00mn 22s)
    Prefetcher vazio
    Reparação de atalhos do navegador
    ========== Estado dos serviços ==========
    AdobeARMservice Parado
    ========== Chaves do Registo ==========
    ELIMINÉ:³ Service: AdobeARMservice
    ========== Valores do Registo ==========
    Ausente Valor Perfil Padrão: FirewallRaz :
    Ausente Valor Perfil Domínio FirewallRaz :
    Nenhum valor presente na chave de exceções do registo (FirewallRaz)
    ProxyFix : Configuração proxy removida com sucesso
    ELIMINÉ ProxyServer Value
    ELIMINÉ ProxyEnable Value
    ELIMINÉ EnableHttp1_1 Value
    ELIMINÉ ProxyHttp1.1 Value
    ELIMINÉ ProxyOverride Value
    ========== Pastas ==========
    Nenhuma pasta CLSID local utilizador vazia
    ELIMINÉ Flash Cookies (0)
    ELIMINÉ Temporários windows (173)
    ========== Ficheiros ==========
    ELIMINÉ: c:\program files (x86)\common files\adobe\arm\1.0\armsvc.exe
    ELIMINÉ Flash Cookies (0) (0 octets)
    ELIMINÉ Temporários windows (1396) (108.944.272 octets)
    ========== Ficheiro HOSTS ==========
    O ficheiro Hosts não foi reparado, por favor, desative o seu antivírus.
    ========== Pastas/Ficheiros ocultos restaurados ==========
    Mes images (My Pictures) : 3 restaurados com sucesso
    Ma musique (My Music) : 1 restaurados com sucesso
    Ma Video (My Video) : 2 restaurados com sucesso
    Mes Favoris (My Favorites) : 2 restaurados com sucesso
    Mes Documents (My Documents) : 6 restaurados com sucesso
    Mon Bureau (My Desktop) : 7 restaurados com sucesso
    Menu demarrer (Programs) : 9 restaurados com sucesso
    Dossier utilisateur (AppData) : 16 restaurados com sucesso
    Programmes (Program Files) : 49 restaurados com sucesso
    ========== Restauração Sistema ==========
    Nenhum ponto de restauro do sistema foi criado
    ========== Recapitulativo ==========
    1 : Chaves do Registo
    9 : Valores do Registo
    3 : Pastas
    3 : Ficheiros
    1 : Ficheiro HOSTS
    1 : Estado dos serviços
    95 : Pastas/Ficheiros ocultos restaurados
    1 : Restauração Sistema
    End of clean in 04mn 18s
    ========== Caminho do ficheiro do relatório ==========
    C:\Users\DoAsnoPC\AppData\Roaming\ZHP\ZHPFix[R1].txt - 25/01/2017 14:08:55 [2287]

    Obrigado,

    Weick


  13. DigRam

    Após os procedimentos, senti uma leve melhora ao ligar o notebook, mas ainda demorou uns bons 3 minutos. E enquanto estou digitanto essa postagem aqui, há momentos em que a digitação para por alguns segundos e depois as letras aparecem bem rapidamente.E

    stou começando a ficar sem esperanças.

    Acho que precisarei formatar novamente ou deve ser alguma falha mecânica.

    Se ainda houver algo que possa fazer, me ajude.

    Obrigado,

    Weick


  14. DigRam,

    O scan inicial deu "no threats found", mas rodei a limpeza assim mesmo. Segue log:

    # AdwCleaner v6.042 - Logfile created 15/01/2017 at 17:24:21
    # Updated on 06/01/2017 by Malwarebytes
    # Database : 2017-01-15.1 [server]
    # Operating System : Windows 10 Pro (X64)
    # Username : DoAsnoPC - DESKTOP-90OM0O5
    # Running from : C:\Users\DoAsnoPC\Desktop\adwcleaner_6.042.exe
    # Mode: Clean
    ***** [ Services ] *****
    ***** [ Folders ] *****
    ***** [ Files ] *****
    ***** [ DLL ] *****
    ***** [ WMI ] *****
    ***** [ Shortcuts ] *****
    ***** [ Scheduled Tasks ] *****
    ***** [ Registry ] *****
    ***** [ Web browsers ] *****
    *************************
    :: Winsock settings cleared
    :: " Image File Execution Options" keys deleted
    :: Proxy settings cleared
    :: IE policies deleted
    :: Chrome policies deleted
    :: Chrome preferences reset: C:\Users\DoAsnoPC\AppData\Local\Google\Chrome\User Data\Default
    :: Hosts file cleared
    *************************
    C:\AdwCleaner\AdwCleaner[C0].txt - [980 Bytes] - [15/01/2017 17:24:21]
    C:\AdwCleaner\AdwCleaner[s0].txt - [1154 Bytes] - [15/01/2017 17:23:38]
    ########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [1125 Bytes] ##########
    Abraço,
    Weick
×

Important Information

Ao usar o fórum, você concorda com nossos Terms of Use.